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(54) FAULT DIAGNOSING METHOD 

(57)Abstract: 

PURPOSE: To provide a method for diagnosing a fault in which 
a small trouble difficult to be detected by a conventional watch 
dog can be detected and its detecting time can be shortened. 
CONSTITUTION: A method for diagnosing faults of control units 
in a control system having a plurality of the control units CPU1. 
CPU2 comprises the steps of processing as prescribed the 
units, mutually comparing output data indicating the processed 
results by a dummy output comparator 80 provided out of the 
units, and diagnosing to be a fault in any unit if both discord. 
The unit can output a dummy output which is not externally 
output of the control system to the comparator in addition to 
the output for an actual control. 
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* NOTICES * 

JPO and NCIPI are not responsible for any 
damages caused by the use of this translation. 

1 .This document has been translated by computer. So the translation may not reflect the original precisely. 
2.**** shows the word which can not be translated. 
3. In the drawings, any words are not translated. 



CLAIMS 



[Claim(s)] 

[Claim 1] The troubleshooting approach which is the troubleshooting approach of each control unit in the 
control system equipped with two or more control units, and the mutual comparison of each output data in 
which this processing result is shown is carried out by the inequality detector in which it was prepared to the 
exterior of a control unit, and is characterized by diagnosing that one of control units is failures at least when 
both are inequalities while making predetermined processing perform to each above-mentioned control unit. 
[Claim 2] It is the troubleshooting approach characterized by outputting the dummy output which is not 
outputted to the exterior of a control system in the troubleshooting approach according to claim 1 apart from 
the output for control with each above-mentioned actual control unit to the above-mentioned inequality 
detector. 



[Translation done.] 
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DETAILED DESCRIPTION 



[Detailed Description of the Invention] 
[0001] 

[Industrial Application] This invention relates to the troubleshooting approach of each control unit in the 

control system equipped with two or more control units. 

[0002] 

[Description of the Prior Art] In order to prevent incorrect actuation of the system by failure of a control unit 
conventionally, when a self-checking function is given to a control unit and it diagnoses as failure by this 
self-test, generally making it make that output cut is performed well (for example, refer to JP,61-107436,A). 
Moreover, when the processing time is supervised and this separates from the predetermined range as such a 
troubleshooting approach of a control unit, and the troubleshooting approach which can be especially 
performed into normal operation, the approach (the so-called watch locking dog) of diagnosing as failure is 
learned, and the method of performing troubleshooting of a control unit is learned by the monitor (internal 
watch locking dog) of the processing time by software, or the monitor (external watch locking dog) of the 
processing time by software and hardware. 

[0003] Especially for example, when it is a control system with a high significance, in order to fully secure 
the dependability like 4WS (four-flower steering) control in an automobile, or ABS control Although it is 
thinking of enabling it to perform control convenient with other control units even if it prepares two or more 
control units and one breaks down Thus, in the control system equipped with two or more control units, the 
fault detection engine performance can greatly be raised by making the health check to which each control 
unit supervises the processing time of other control units perform. 
[0004] 

[Problem(s) to be Solved by the Invention] However, in the control system equipped with two or more 
control units as mentioned above, when the mutual processing time is supervised, fault detection is 
performed by the watch locking-dog function prepared in each control unit and all the following failures 
occur in coincidence, it is difficult to detect this. 

** When all the control units break down according to generating of a source effect or a heavy current 
community noise etc. 

** When it is failures of a type undetectable [ with a watch locking dog ], such as failure while performing 
processing set as the object of a watch locking dog in a watchdog timer. 

** When it is the failures which do not start a health check, such as failure which passes the program of a 
health check. 

Although the above failures of the probability of the generating are very low, when the dependability of a 
system is extremely required of altitude, to enable it to detect this is desired. 

[0005] Moreover, since the above-mentioned watch locking dog supervises the processing time over fixed 
processings, such as for example, a control period, it cannot obtain the result of troubleshooting until the 
processing time (for example, one period of control) passes at least. Furthermore, since the above-mentioned 
watch locking dog was only processing which finally compares a timer value, the applicable range was 
limited to some extent. 

[0006] Then, with the conventional watch locking dog, this invention can also detect the slight failure with 
difficult detection, and is made for the purpose of offering the troubleshooting approach which can 
moreover shorten detection time. 
[0007] 

[Means for Solving the Problem] For this reason, it is the troubleshooting approach of each control unit in 
the control system equipped with two or more control units, and invention of the 1st of this application 
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carries out the mutual comparison of each output data in which this processing result is shown by the 
inequality detector in which it was prepared to the exterior of a control unit, and when both are inequalities, 
it is characterized by diagnosing that one of control units is failures at least, while making predetermined 
processing perform to each above-mentioned control unit. 

[0008] Moreover, invention of the 2nd of this application is characterized by each above-mentioned control 
unit outputting the dummy output which is not outputted to the exterior of a control system to the above- 
mentioned inequality detector apart from the output for actual control in the 1st above-mentioned invention. 
[0009] 

[Effect of the Invention] According to invention of the 1st of this application, the inequality detector which 
detects failure of each control unit Since it is prepared in the exterior of a control unit, while being able to 
compare about each control unit by the result of the last which finished all processings and being able to 
perform more synthetic fault detection To being one or more periods of control, by this invention approach, 
the time amount which a failure judging takes is only gap of the clock between control units or an output 
period, and can usually shorten failure judging time amount sharply with the conventional watch locking 
dog. Moreover, since fault detection is performed by detecting the inequality of a processing result in the 
above-mentioned inequality detector, only by processings differing slightly between each control unit, a 
thing judgment is made and a mutual processing result can detect failure of each control unit more certainly 
compared with a different case where the AND circuit is generally performing fault detection 
conventionally. Therefore,, even when it is unusual, few things [ things ] do not start coincidence failure, the 
conventional watch locking dog, or health check of all control units and which detect become possible. 
Furthermore, since the data of the processing result instead of easy timer processing can be compared like 
the conventional watch locking dog, the applicability of troubleshooting can be extended compared with the 
former. 

[0010] Moreover, according to invention of the 2nd of this application, fundamentally, the same 
effectiveness as the 1st above-mentioned invention can be done so. And moreover, apart from the output for 
actual control, since each above-mentioned control unit can output the above-mentioned dummy output to 
the above-mentioned inequality detector, also about the various processings which catmot be outputted to 
the exterior of a control system, it can compare the processing result of each control unit, and can extend the 
applicability of troubleshooting further. 
[0011] 

[Example] The case where the example of this invention is hereafter applied to troubleshooting of the 
control unit which performs ABS / traction control of an automobile is taken for an example, and it explains 
to a detail based on an accompanying drawing. First, the automobile conceming this example mainly 
concerns and the configuration of a brake fluid pressure circuit is explained. For 1 floor line, in drawing 1 , a 
forward left ring and IFR are [ a left rear ring and IRR of a forward right ring and IRL ] right rear rings. An 
engine 2 is carried in car-body anterior part every width, and after the generating torque in this engine 2 is 
transmitted to a clutch 3, a change gear 4, and the differential gear 5, it is transmitted to forward left ring 
1 floor line through right drive shaft 6R again at forward right ring IFR through left drive shaft 6L. Thus, 
front- wheel 1 floor line and IFR are used as a driving wheel, and let the car be the front drive vehicle with 
which rear wheel IRL and IRR were used as the coupled driving wheel. 

[0012] Let brake 7FR-7RR with which each wheel was equipped be the disk brake made into the oil 
pressure controller. Moreover, let the master cylinder 8 as a brake fluid pressure generation source be the 
tandem die which has two deliveries 8a and 8b. The brake piping 13 extended from one delivery 8a of this 
master cylinder 8 branches to two on the way, branch-line 13F are connected to forward left rotational 
application brake 7floor line (wheel cylinder equipped in the caliper), and branch-line 13R is connected to 
right rear rotational application brake 7RR. The branch line 14 extended from delivery 8b of another side of 
a master cylinder 8 also branches to two, branch-line 14F are connected to forward right rotational 
application brake 7FR, and branch-line 14R is connected to left rear rotational application brake 7RL. 
[0013] Electromagnetic fluid pressure regulator- valve 15L or 15R is connected to the branch lines 13F and 
14F for the object for front wheels, i.e., driving wheels, and electromagnetic closing motion valve 16L or 
16R is connected to the branch lines 13R and 14R for rear wheels at them. The fluid pressure regulator 
valves 1 5L and 1 5R switch the brake fluid pressure supply from the master cylinder 8 to brake 7floor line 
and 7FR, and the mode which releases the brake fluid pressure of this brake 7floor line and 7FR to the 
reservoir tanks 22L and 22R through Piping 21 L and 21R, and this change-over control is performed by the 
control signal from the control unit with which the control section U was equipped. Moreover, the brake 
fluid of reservoir tank 21 L is returned to piping 1 3 by pump 23L through piping 25L to which check valve 
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, 24L was connected, and the brake fluid of reservoir tank 22R is similarly returned to piping 14 by pump 
23 R through piping 25R to which check valve 24R was connected. 

[0014] The treading-in force over a brake pedal 12 is transmitted to a master cylinder 8 through a booster 
1 1 , i.e., a brake booster. Although it is the same as the vacuum booster well known from the former 
fundamentally, this booster 1 1 is constituted so that a redoubling operation may be performed, even if 
treading-in actuation of a brake pedal is not more preferably performed so that it may mention later in the 
case of slip control. 

[001 5] A booster 1 1 has the case 31 fixed to the car body and the master cylinder 8, and the inside of this 
case 31 is formed by 35 [ room / 1st / room / 2nd ] with 34 with diaphram 32 and the valve body 33 fixed to 
this. The 1 st room (for example, inhalation-of-air negative pressure of an engine 2) of negative pressure is 
always supplied to 34, when treading-in actuation of the brake pedal is not carried out, 35 [ room / 2nd / 
room / 1st ] is opened for free passage with 34, and it considers as the condition that actuation of a booster 
1 1 was suspended. And if a brake pedal 12 is broken in and operated, the 2nd room of an atmospheric 
pressure is supplied to 35, diaphram 32 will displace to the front with a valve body 33 by this, and a 
redoubling function will be performed. 

[0016] Fundamentally, the 2nd room of a change with the negative pressure supply and atmospheric- 
pressure supply to 35 is made with the valve gear equipped in the valve body 33. This valve body 33 part is 
explained based on drawing 2 . First, a valve body 33 has the power piston 41 fixed to diaphram 32, and 
fitting of a reaction disc 42 and the end face section of an output shaft 43 is carried out into crevice 41a 
formed in this power piston 41. This output shaft 43 tums into an input shaft of a master cylinder 8. 
Moreover, the valve plunger 45 is attached in the valve body 33 at the point of the input shaft 44 connected 
with the brake pedal 12. The vacuum valve 46 is arranged behind this valve plunger 45. 
[0017] The pressure installation path 50 is formed in the power piston 41, and this pressure installation path 
50 is always opened for free passage by the space X formed in the perimeter of said valve plunger 45. The 
2nd room of this space X is always opened for free passage with 35. And the valve seat 47 by which said 
vacuum valve 46 is ******(ed) by the open end by the side of the space X of the pressure installation path 
50 is formed. Moreover, the vacuum valve 46 is ******(ed) also to valve seat 45a formed in the back end of 
a valve plunger 45. 

[0018] In the above configurations, the case where negative pressure is now introduced into the pressure 
installation path 50 is assumed. It is estranged in ** and the valve seat 47 to which it is in the condition of 
drawing 2 , and the vacuum valve 46 sits down to valve seat 45a according to the energization force of 
springs 48 and 49 in this condition when treading-in actuation of the brake pedal 12 is not carried out. 
Therefore, the 2nd room of the negative pressure from the pressure installation path 50 is introduced into 35 
through Space X, and a redoubling operation is not performed. 

[0019] If a brake pedal 12 is broken in and operated, drawing) of an input shaft 44, 

therefore the valve plunger 45 will be carried out. In the case of this ******^ ^he vacuum valve 46 sits down 
to a valve seat 47 first, and intercepts a free passage with Space X and the pressure installation path 50, and 
valve seat 45a is estranged to the vacuum valve 46 after that. When this vacuum valve 46 and valve seat 45a 
estrange, the atmospheric pressure from the back of a valve body 33 is introduced into Space X, and 35 
[ room / 2nd ] becomes atmospheric pressure. By this, diaphram 32 displaces to the front with a valve body 
33, consequently an output shaft 43 ******^ and a redoubling operation is performed. The brake reaction 
force from a master cylinder 8 is transmitted to a valve plunger 45, therefore a brake pedal 12 through a 
reaction disc 42. When the treading-in operating physical force of a brake pedal 12 is released, it will retum 
to the condition of drawing 2 with a retum spring 36 (refer to drawing 1 ), and will prepare for the next 
redoubling operation. 

[0020] Although the part explained above is the same as a known vacuum booster, he is trying to switch it to 
the condition of making the condition of making the 1st room of the negative pressure of 34 introducing to 
the pressure installation path 50 for slip control, and atmospheric pressure introducing more preferably, by 
this example. That is, the 1st room of 34 and the pressure installation path 50 are connected through piping 
37, and the method solenoid operated directional control valve 38 (refer to drawing 1 ) of three is connected 
to this piping 37. This change-over valve 38 makes 34 open the 1st room of the pressure installation path 50 
for free passage at the time of demagnetization, and makes the pressure installation path 50 introduce 
atmospheric pressure at the time of excitation. When this change-over valve 38 is excited and an 
atmospheric pressure is introduced into the pressure installation path 50, 35 becomes an atmospheric 
pressure even if the 2nd room of treading-in actuation of a brake pedal 12 is not performed by 
aforementioned following space X, consequently it performs a redoubling operation, and makes a master 
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cylirjder 8 generate brake fluid pressure. 

[0021] Drawing 3 shows a control system in simple, and the inside U of the said drawing is the control 
section which has the control unit constituted using micro KONKO pewter. Later, the control unit of 
plurality (for example, two pieces) is prepared in this control section U so that it may explain in detail. A 
sensor or the signal from switches S1-S8 is inputted into the control unit in the above-mentioned control 
section U. a sensor SI - S4 ~ each — the rotational speed of wheel 1 floor-line- IRR is detected. A switch S5 
is an accelerator switch set to ON, when an accelerator pedal 1 0 becomes a close by-pass bulb completely. 
Switches S6 and S7 operate, when treading-in actuation of the brake pedal 12 is carried out, respectively, 
one switch is used as a normally open mold, for example, the normally closed mold of another side is 
carried out. A sensor SB detects an engine speed. Moreover, although outputted to each equipment shown in 
drawing 3 from the control unit in a control section U, a sign 9 is a torque adjustment device which adjusts 
the generating torque of an engine 2. In addition, the torque adjustment device 9 performs generating torque 
adjustment with carrying out inhalation air content adjustment, for example or the combination of the 
number of fuel cut gas columns, and ignition timing adjustment. 

[0022] Next, the outline of slip control is explained, also referring to drawing 4 . In addition, drawin g 4 has 
shown the case where the slip had not arisen in left driving wheel 4floor line, and a big slip arises in right 
driving wheel IFR to the example. 

[0023] ** an engine system — first, initiation of engine control is started, when the slip value of the larger 
one tums into more than a predetermined initiation threshold among each slip value of right-and-left front- 
wheel 1 floor line and IFR (at the tl time of drawing 4 ). Engine control is performed by carrying out 
feedback control of the torque adjustment device 9 so that an actual slip value may tum into the desired 
value STE for engines (the 1st desired value). The termination of engine control is performed, when an 
accelerator becomes a close by-pass bulb completely, or when the time amoimt from which the actual slip 
value was set to threshold SC for control continuation (it is smallness from the 1st desired value) continues 
beyond predetermined time (t6-t7 of drawing 4 ). 

[0024] ** Initiation of brake control brake control is considered as the time of satisfying all the following 
conditions. The 1st start condition is [ engine ] under control. The 2nd start condition is that the difference 
of the actual slip value of right-and-left driving wheel IFl and IFR became beyond a predetermined value 
(t2 of drawing 4 ), the 1st [ predetermined / start condition / 3rd / in the vehicle speed ] — it is less than 
[ vehicle speed VI ]. The 4th start condition is having gone through the predetermined time delay mentioned 
later. 

[0025] while expecting response delay, exciting initiation, simultaneously the change-over valve 38 of 
engine control in advance of initiation of this brake control and making a booster 1 1 into a redoubling 
operation condition ~ the fluid pressure regulator valves 1 5L and 1 5R — a relief location — moreover, let the 
closing motion valves 16L and 16R be close. And brake control will be started, if an actual slip value comes 
to show predetermined deceleration after exciting a change-over valve 38 (time amount until predetermined 
deceleration is shown made into said time delay drawing 4 between t2-t3). 

[0026] Individual independence is achieved about right-and-left driving wheel IFl and IFR, and brake 
control is performed by carrying out feedback control of the fluid pressure regulator valves 1 5L and 1 5R so 
that a respectively actual slip value may tum into the desired value STB for brakes (the 2nd desired value) 
(> STE) (duty control). 

[0027] The termination of brake control is performed when any following one condition is satisfied. The 1st 
termination condition is a time of engine control being stopped. The 2nd termination condition is a time of 
the vehicle speed turning into the high vehicle speed more than 2nd vehicle speed V2 (V2> VI) 
predetermined. It is a time of each control signal over the fluid pressure regulator valves 1 5L and 1 5R on 
either side showing reduced pressure, £ind the 3rd termination condition carrying out predetermined time 
(example 500msec(s)) continuation (t4-t5 of drawing 4 ). 

[0028] The 4th termination condition is [ both ] a time of the brake fluid pressure of brake 7floor line on 
either side and 7FR becoming zero. It is a time of the 5th termination condition being detected with either of 
the switches S6 and S7 that treading-in actuation of the brake pedal 12 was carried out (when it is detected 
that treading-in actuation of the brake pedal 12 is carried out by switches S6 and S7, initiation of brake 
control is forbidden). 

[0029] As long as engine control is performed in the case of a brake control termination, the change-over 
valve 38 is operating, the fluid pressure regulator valves 15L and 15R are in a relief location, and the closing 
motion valves 16L and 16R are made into a closed state (the same condition as the standby condition to 
brake control initiation). And when treading-in actuation of the time of engine control being stopped or the 
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brake pedal 12 is carried out, a change-over valve 38 is demagnetized. 

[0030] In this example, as described above, control of fluid pressure regulator-valve 15L which adjusts the 
brake fluid pressure by the side of a front wheel, i.e., a driving wheel, and 15R ** is performed by the 
control signal from the control unit in the above-mentioned control section U, but the above-mentioned 
control section U is equipped with two control units, and even when both [ these ] control units perform 
troubleshooting by the health check and either breaks down, it can perform control convenient by another 
side. 

[003 1 ] Hereafter, the troubleshooting approach of the control unit of the above-mentioned plurality (two 
pieces) is explained. As shown in drawing 5 , the above-mentioned control section can be equipped with two 
control units CPU! and CPU2, and the data exchange of both control unit CPUl and CPU2 can be mutually 
carried out now. The dummy output section (output terminal: Tdl, Td2) which outputs the dummy signal for 
troubleshooting is prepared so that each control units CPUl and CPU2 may be explained in detail in the 
back other than the output section (output terminal: Tal, Ta2) which outputs an original control signal. The 
dummy signal outputted from each control units CPUl and CPU2 is inputted into the dummy output 
comparator circuit 80 as an inequality detector as used in the field of this application while it is inputted into 
the watch locking-dog circuit 85. The output latch circuit 90 is formed in the output side of the above- 
mentioned watch locking-dog circuit 85 and the dummy output comparator circuit 80. Moreover, the reset 
circuit 95 is attached to this output latch circuit 90. 

[0032] moreover — this example — the above-mentioned fluid pressure regulator valve 15 (15L, 15R) — 
electromagnetism — it consists of solenoid valves, for example, is operated by the output signal (solenoid 
output) from one control unit CPU2, and the failsafe relay 101 and the waming lamp 102 are formed in the 
solenoid-valve drive circuit. 

[0033] The above-mentioned dummy output is the output signal generated apart from the output for actual 
control for [ which is not outputted to the exterior of a control system ] troubleshooting. As an approach of 
generating this dummy output, how to make dummy output data change periodically independently with 
actual control can be considered, for example according to a certain fixed convention. Moreover, after 
processing the output data used for actual control instead of a dummy output remaining as it is or if needed, 
you may make it output as a dummy output. Furthermore, although it is difficult to carry out during actual 
control, it is good also considering the result of carrying out functional actuation of all the hardware inside 
CPU, as a dummy output. Furthermore, since that detection will become difficult again if failure arises in 
this fixed place when the data of a dummy output become fixed, you may make it use the data which 
performed a certain processing and were changed as a dummy output. 

[0034] Moreover, the following approaches can be considered as an output method of the above-mentioned 
dummy output data. 

- The dummy output of the dummy output data is carried out with pulse width (PWM). In this case, you may 
make it expand or reduce pulse width. 

- The dummy output of the dummy output data is carried out a pulse period (FM). 

- D/A conversion of the dummy output data is carried out, and a dummy output is carried out with an analog 
quantity. 

- The dummy output of the dummy output data is carried out at parallel. 

[0035] By equipping the above-mentioned dummy output comparator circuit 80 with an exclusive "or" 
circuit 81, and detecting an inequality about two output signals inputted from control units CPUl and CPU2 
Detect failure of control units CPUl and CPU2, and only by processings differing slightly among each 
control units CPU [ CPUl and ] 2, mutual processing results differed and a thing judgment is made. 
Conventionally, generally an AND circuit can detect more certainly failure of each control units CPUl and 
CPU2 compared with the case where fault detection is being performed. 

[0036] It judges with the above-mentioned watch locking-dog circuit 85 being unusual, when the processing 
time is supervised about each control units CPUl and CPU2, this separates from the predetermined range 
and level change of each output does not occur beyond fixed time amount in this example, while having the 
fault detection function judged to be unusual as well known from the former. Moreover, when abnormalities 
are detected in the above-mentioned dummy output comparator circuit 80, after power-off is carried out, the 
above-mentioned output latch circuit 90 is a circuit which latches a control output until it is turned on again, 
and cuts a solenoid drive circuit with an output cut signal. When it latches an abnormality decision output, a 
reset circuit 95 is a reset circuit prepared in order to check actuation of this circuit, and can carry out the 
actuation check of stopping an engine etc. by forming this circuit 95, without turning off a system 
completely. However, in this example, the count which can reset the above-mentioned output latch circuit is 
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restricted at once more preferably. 

[0037] In the above configuration, if a system is started, data communication will be performed among both 
the control units CPU [ CPUl and ] 2, and input data and dummy output mode (it changes for every control 
period) will be exchanged. And a certain promised same processing (operation) is performed by each control 
units CPU! and CPU2. And a synchronous output is carried out to the above-mentioned dxinmiy output 
comparator circuit 80 by considering the result of an operation as a dummy output, and 
coincidence/inequality is made to judge by the exclusive "or" circuit 81. And in the case of an inequality, it 
is judged with it being unusual. As a result of the above-mentioned comparison test, a partner control unit, 
coincidence, or when mostly in agreement, it uses for the operation of subsequent actual control, one of 
control units 2, for example, control unit CPU. 

[0038] The following approaches can be considered when carrying out an abnormality judging in the above- 
mentioned dummy output comparator circuit 80. 

- The timer which permits the maximum of gap (a clock gap and synchronous gap) of the output of forward 
always is given, and it judges with it being unusual with inequality time amount exceeding this. 

- It judges with the time of the inequality time amount except gap of the output of forward always being 
integrated beyond fixed time amount being unusual. (Addition is performed to the inside of predetermined 
time, or reset) - It judges with the time of the inequality of the time amount exceeding gap of the output of 
forward always being integrated more than the count of predetermined being unusual. [(Addition is 
performed to the inside of predetermined time, or reset) 0039] An example of the abnormality judging by 
the above approaches is shown in the graph of drawing 6 . That is, if it is not judged with abnormalities, but 
gap of an output becomes large above to some extent (deltaT2) and the maximum of output gap of always 

[ forward ] is exceeded when gap of the dummy output of both the control units CPUl and CPU2 is very 
small (deltaTl) and smaller than output gap of forward always, it will be judged with it being unusual. 
Moreover, an abnormality judging is performed by operation of the watch locking-dog circuit 85 when the 
level is fixed for the dummy output of both the control units CPUl and CPU2 beyond predetermined time 
(deltaT3). 

[0040] In addition, when making it calculate based on the data which are easy to shift especially in time 
when sampling a signal fi-om a wheel speed sensor and considering as input data for example, you may 
make it make the result of an operation in agreement by the following approaches based on exchange of 
input data so that a judgment result may not become too severe by unescapable gap of this input data. 

- The result of an operation is made in agreement by the same input data and the same data processing. 

- When input data differs and it is the almost same input data, it is made for the result of an operation to 
become almost the same. 

- When input data differs, it calculates using the decided input data group, and the result of an operation is 
made in agreement. In this case, you may make it carve the decided input data group by the switch input. 
[0041] As explained, according to this example, as mentioned above, the dummy output comparator circuit 
80 which detects failure of each control units CPUl and CPU2 Since it is prepared in the exterior of control 
units CPUl and CPU2, while being able to compare about each control units CPUl and CPU2 by the result 
of the last which finished all processings and being able to perform more synthetic fault detection To being 
one or more periods of control, by this example, the time amount which a failure judging takes is only gap 
of the clock between control units CPU [ CPUl and ] 2 or an output period, and can usually shorten failure 
judging time amount sharply with the conventional watch locking dog. Moreover, since fault detection is 
performed by detecting the inequality of a processing result in the above-mentioned dummy output 
comparator circuit 80, only by processings differing slightly among each control units CPU [ CPUl and ] 2, 
a thing judgment is made and the mutual processing result can detect more certainly failure of each control 
units CPUl and CPU2 compared with a different case where the AND circuit is generally performing fault 
detection conventionally. Therefore, even when it is unusual, few things [ things ] do not start coincidence 
failure, the conventional watch locking dog, or health check of both the control units CPUl and CPU2 and 
which detect become possible. Furthermore, since the data of the processing result instead of easy timer 
processing can be compared like the conventional watch locking dog, the applicability of troubleshooting 
can be extended compared with the former. 

[0042] Apart fi-om the output for actual control, since especially each above-mentioned control units CPUl 
and CPU2 can output the above-mentioned dummy output to the above-mentioned dummy output 
comparator circuit 80, also about the various processings which cannot be outputted to the exterior of a 
control system, they can compare the processing result of each control units CPUl and CPU2, and can 
extend the applicability of troubleshooting fiirther. 
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[0043] In addition, although the above-mentioned example was equipped with two control units which have 
the same function, it can have a reliable troubleshooting function comparatively at a low price and similarly 
by carrying out only to troubleshooting which does not instead have a control fixnction [ as opposed to the 
exterior for one unit ]. In this case, as it is the following, mitigation of the amount of operations can be 
aimed at. 

- According to an input state, only for example, the control modes ~ what kind of control throat contents 
like are performed ~ are judged, and let this be dummy output data. 

- Only the processing time of other control units is judged according to an input state, and they are other 
control YUNITSU. It compares with the actual processing time of TO. In this case, place to the pattern of 
processing, and it It is necessary to give the data of ******. 
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- * NOTICES* 

JPO and NCIPI are not responsible £or any 
damages caused by the use o£ this translation. 

1 .This document has been translated by computer. So the translation may not reflect the original precisely. 
2.**** shows the word which can not be translated. 
3. In the drawings, any words are not translated. 
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